[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

| 1. Introduction.....................................................................................................................................1   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.4.1. Enterprise Risk Management and C-SCRM Owners and Operators.............................................5                                         |
| 1.4.2. Enterprise, Agency, and Mission and Business Process Owners and Operators .........................5                                             |
| 1.4.3. Acquisition and Procurement Owners and Operators.................................................................6                               |
| 1.4.4. Information Security, Privacy, or Cybersecurity Operators .........................................................6                             |
| 1.4.5. System Development, System Engineering, and System Implementation Personnel.................7                                                    |
| 1.5.1. Enterprise's Supply Chain.............................................................................................................9          |
| 1.5.2. Supplier Relationships Within Enterprises .................................................................................10                    |
| 2. Integration of C-SCRM Into Enterprise-Wide Risk Management...................................................... 18                                  |
| 2.3.1. Roles and Responsibilities Across the Three Levels ...................................................................24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

There may be references in this publication to other publications currently under development by NIST in
accordance with its assigned statutory responsibilities. The information in this publication, including
concepts, practices, and methodologies may be used by federal agencies even before the completion of
such companion publications. Thus, until each publication is completed, current requirements, guidelines,
and procedures, where they exist, remain operative. For planning and transition purposes, federal
agencies may wish to closely follow the development of these new publications by NIST. The National Institute of Standards and Technology (NIST) Information Technology Laboratory
(ITL) promotes the U.S. economy and public welfare by providing technical leadership for the
Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference
data, proof of concept implementations, and technical analyses to advance the development
and productive use of information technology (IT). ITL’s responsibilities include the development
of management, administrative, technical, and physical standards and guidelines for the cost-
effective security of other than national security-related information in federal information
systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach
efforts in information systems security and privacy and its collaborative activities with industry,
government, and academic organizations. This publication provides a methodology and set of procedures for conducting assessments of
security and privacy controls employed within systems and organizations within an effective risk
management framework. The assessment procedures, executed at various phases of the system
development life cycle, are consistent with the security and privacy controls in NIST Special
Publication 800-53, Revision 5.

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Asset Management:

actual state; assessment; authorization boundary; automation; capability; continuous diagnostics and mitigation; dashboard; defect; desired state specification; firmware; information security continuous monitoring; ISCM; inventory management; malicious code; malware; mitigation; mobile code; ongoing assessment; root cause analysis; security capability; security control; security control item; software; software asset management; software file; SWID tag; whitelisting.

The scope of this report is limited to security controls and control items that are implemented to manage the download, installation, and execution of unauthorized and malicious software (malware). 4 In this case, malware refers to known and unknown malicious code, including software that executes a zero-day attack.

4 Malware, also known as malicious code, refers to a software program that is covertly inserted into another software program with the intent to destroy data, run destructive or intrusive software programs, or otherwise compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system. Source: Souppaya M., Scarfone K., (2013) (National Institute of Standards and Technology, Gaithersburg, MD), Guide to Malware Incident Prevention and Handling for Desktops and Laptops, NIST Special Publication (SP) 800-83, https://doi.org/10.6028/NIST.SP.800-83r1.

Automation Support for Security Control Assessments_ Software Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security:

.....................................................1 | 1. Introduction .........................................................................................................................1 | 1.
Introduction .........................................................................................................................1 |                                                                                |
|                                                                                | 1.1                                                                                | Purpose and Scope                                                                                | ....................................................................................................1                                    |
|                                                                                | 1.2                                                                                | Audience.....................................................................................................................1             |                                                                                |
|                                                                                | 1.3                                                                                | Document Structure....................................................................................................1                    |                                                                                |
| 2.

Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Derived PIV Application and Data Model Test Guidelines:

| DTR No:         | DTR Description                                                                                | Spec. Reference                                                           |
|-----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------|
| DTR-06.01.01.01 | For a Universal Integrated Circuit Card (UICC) used to host a Derived PIV Application, the UICC shall implement the GlobalPlatform Card Secure Element Configuration v1.0 [GPSE]. | • [SP800-157], Section 3.3.1.2 - Removable UICC with Cryptographic Module |

| DTR No:         | DTR Description                                                                                | Spec. Reference                                                      |
|-----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------|
| DTR-06.01.02.01 | For a USB Integrated Circuit(s) Card Device (ICCD) used to host a Derived PIV Application, the ICCD shall comply with the Universal Serial Bus Device Class - Smart Card ICCD Specification for USB Integrated Circuit(s) Card Devices [ICCDSPEC].

Derived PIV Application and Data Model Test Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Access Control?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## 03.01.06      Least Privilege - Privileged Accounts

[SELECT FROM: access control policy and procedures; procedures for least privilege; list of system-generated privileged accounts; list of system administration personnel; system audit records; system configuration settings; system security plan; list of system-generated security functions or security-relevant information assigned to system accounts or roles; other relevant documents or records]

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Computer Security Division 2008 Annual Report:

systems for potential federal agency use - Hosted a growing repository of federal agency security practices, public/private security practices, and security configuration checklists for  IT  products.
In  conjunction  with  the  Government  of  Canada's Communications Security Establishment, CSD leads the Cryptographic Module Validation Program (CMVP). The Common Criteria Evaluation and Validation Scheme (CCEVS) and CMVP facilitate security testing of IT products usable by the federal government. - Solicit recommendations of the Information Security and Privacy ◆◆ Advisory  Board  on  draft  standards  and  guidelines -  Solicited recommendations of the Board regularly at quarterly meetings. - Provide outreach, workshops, and briefings ◆◆ - Conducted ongoing awareness  briefings  and  outreach  to  CSD's  customer  community and beyond to ensure comprehension of guidance and awareness of planned  and  future  activities. CSD  also  held  workshops  to  identify areas that the customer community wishes to be addressed, and to scope guidelines in a collaborative and open format. - Satisfy annual NIST reporting requirement ◆◆ - Produced an annual report  as  a  NIST  Interagency  Report  (IR). The  2003-2007  Annual Reports  are  available  via  our  Computer  Security  Resource  Center (CSRC) website or upon request.

Computer Security Division 2008 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance:

| Executive Summary..................................................................................................... vi        | Executive Summary..................................................................................................... vi        | Executive Summary..................................................................................................... vi   |
|----------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction ............................................................................................................1    | 1. Introduction ............................................................................................................1    |                                                                                |
|                                                                                | Purpose and Scope                                                                                | ........................................................................................ 1                                  |
|                                                                                | Audience.........................................................................................................

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.15 (NIST 3.1.15)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.1.15. 3.1.15.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Digital Identity Guidelines:

There may be references in this publication to other publications currently under
development by NIST in accordance with its assigned statutory responsibilities. The
information in this publication, including concepts and methodologies, may be used by
federal agencies even before the completion of such companion publications. Thus, until
each publication is completed, current requirements, guidelines, and procedures, where
they exist, remain operative. For planning and transition purposes, federal agencies may
wish to closely follow the development of these new publications by NIST.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface:

FIPS 201 defines the requirements and characteristics of government-wide interoperable identity credentials. It specifies that these identity credentials must be stored on a smart card and that additional common identity credentials, known as derived PIV credentials, may be issued by a federal department or agency and used when a PIV Card is not practical. This document contains the technical specifications to interface with the smart card to retrieve and use the PIV identity credentials. The specifications reflect the design goals of interoperability and PIV Card functions. The goals are addressed by specifying a PIV data model, card edge interface, and application programming interface. Moreover, this document enumerates requirements for the options and branches in international integrated circuit card standards. The specifications go further by constraining interpretations of the normative standards to ease implementation, facilitate interoperability, and ensure performance in a manner tailored for PIV applications.

FIPS 201 defines processes for binding identities to authenticators, such as the PIV Card and derived PIV credentials used in the federal PIV system. SP 800-73-5 contains the technical specifications to interface with the PIV Card to retrieve and use the identity credentials. The specifications reflect the design goals of interoperability and PIV Card functions. The goals are addressed by specifying a PIV data model, card edge interface, and application programming interface. Moreover, this document enumerates requirements for the options and branches in international integrated circuit card (ICC) standards [ISO7816]. The specifications go further by constraining interpretations of the normative standards to ease implementation, facilitate interoperability, and ensure performance in a manner tailored for PIV applications.

## 3.2. Entry Points for Data Access

Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security:

| Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi   |
|--------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction .........................................................................................................................1 | 1. Introduction .........................................................................................................................1 | 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Forensics Web Services (FWS):

Yet another important principle that any evidence should have is reliability. In the court of law, digital  evidence  must  be  presented in  an  articulate  manner. Because impersonation and replay attacks do occur in web services, cryptographic mechanisms would help to protect ownership of information passed around in messages by signing them digitally. Such a requirement, of course, would  entail  web  services  using  a  cryptography  platform  such  as  Public  Key  Infrastructure (PKI). Robinson [12] influenced the model employed through FWS for pair-wise evidence generation with some differences. Robinson [12] provides a framework to support fair B2B communications

- [1] A. Vorobiev  and  H. Jun,  "Security  Attack  Ontology  for  Web  Services,"  in Semantics, Knowledge and Grid, 2006. SKG '06. Second International Conference on , 2006, pp. 4242. - [2] Y. Demchenko, L. Gommans, C. de Laat, and B. Oudenaarde, "Web services and grid security vulnerabilities and threats analysis and model," in Grid Computing, 2005. The 6th IEEE/ACM International Workshop on , 2005, p. 6 pp. - [3] A. Singhal, T. Winograd, and K. Scarforne, NIST Special Publication 800-95, "Guide to Secure    Web  Services'  ,  August    2007,  http://csrc.nist.gov/publications/nistpubs/80095/SP800-95.pdf. - [4] R. Khalaf, N. Mukhi, and S. Weerawarana, "Service-Oriented Composition in BPEL4WS," in Twelfth International World Wide Web Conference , Budapest, Hungary, 2003. - [5] S. M. S. Cruz, M. L. M. Campos, P. F. Pires, and L. M. Campos, "Monitoring e-business Web  services usage through a log based architecture," in Web  Services, 2004. Proceedings. IEEE International Conference on , 2004, pp. 61-69. - [6] A. Herzberg  and  I. Yoffe,  "The  Delivery  and  Evidences  Layer,"  Cryptology  ePrint Archive Report 2007/139, 2007. - [7] S. Kremer,  O. Markowitch,  and  J. Zhou,  "An  Intensive  Survey  of  Non-repudiation protocols," Computer Communications, vol. 25, pp. 1606-1621, 2002. - [8] P.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.15 (NIST 3.1.15)?

[Assistant]
According to Guidelines for Smart Grid Cybersecurity:

3.1.15 Sensitive Data Protection Vulnerability (CWE-199)

Description

OWASP describes the sensitive data protection vulnerability as follows:

This category is for tagging vulnerabilities that lead to insecure protection of sensitive
data.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 1?

[Assistant]
According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services:

<!-- image -->

## NIST Internal Report NIST IR 8323r1

## Foundational PNT Profile: Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services

Michael Bartock

Joseph Brule

Ya-Shian Li-Baboud

Suzanne Lightman

James McCarthy

Karri Meldorf

Karen Reczek

Doug Northrip

Arthur Scholz

Theresa Suloway

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8323r1

<!-- image -->

## NIST Internal Report NIST IR 8323r1

## Foundational PNT Profile: Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services

Michael Bartock Suzanne Lightman Computer Security Division Information Technology Laboratory

Ya-Shian Li-Baboud

Software Systems Division Information Technology Laboratory

James McCarthy Applied Cybersecurity Division Information Technology Laboratory

Karen Reczek Standards Coordination Office Laboratory Programs

Joseph Brule Karri Meldorf Doug Northrip Arthur Scholz Theresa Suloway The MITRE Corporation

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8323r1

January 2023

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications.

Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Security Segmentation in a Small Manufacturing Environment provide?

[Assistant]
<!-- image -->

## NIST Cybersecurity White Paper NIST CSWP 28

## Security Segmentation in a Small Manufacturing Environment

Dr. Michael Powell National Cybersecurity Center of Excellence National Institute of Standards and Technology

John Hoyt Aslam Sherule Dr. Lynette Wilcox The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.CSWP.28

April 6 , 2023

<!-- image -->

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. ## NIST Technical Series Policies

Copyright, Fair Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-03-3 0

## How to Cite this NIST Technical Series Publication:

Powell M, Hoyt J, Sherule A, Wilcox L (202 3 ) Security Segmentation in a Small Manufacturing Environment. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 28. https://doi.org/10.6028/NIST.CSWP.28

## Author ORCID iDs

Dr. Michael Powell: 0000-0002-3922-7435 John Hoyt: 0000-0002-0783-7036 Aslam Sherule: 0000-0002-2003-3817 Dr. Lynette Wilcox: 0000-0003-1246-6505

## Contact Information

manufacturing\_nccoe@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

Manufacturers are increasingly targeted in cyber-attacks.

Security Segmentation in a Small Manufacturing Environment

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 2?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

aft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-04-23 Supersedes NIST Special Publication 800-171r2 (February 2020; Includes updates as of 01-28-2021) https://doi.org/10.6028/NIST.SP.800-171r2

## How to Cite this NIST Technical Series Publication:

Ross R, Pillitteri V (2024) Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures:

3.1.4. 3.1.4.

Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Standard Security Label for GOSIP_ an Invitational Workshop:

3.1.1 The impact of the sweeping revisions to the identification of sensitive information varied among the federal departments.

Standard Security Label for GOSIP_ an Invitational Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Computer Security Division 2012 Annual Report:

| Table of Contents                                                                                | ........................................ iii   |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------|
| Welcome Letter                                                                                | ...........................................1   |
| Division Organization                                                                                | ....................................2          |
| Intro to CSD's 5 Groups                                                                                | ..................................3            |
| Cryptographic Technology Group                                                                                | .......................... 3                   |
| Security Components and Mechanisms Group........... | 4                                              |
| Secure Systems and Applications Group.................. | 4                                              |
| Security Outreach and Integration Group................ | 5                                              |
| Security Testing, Validation, and Measurement Group...

Computer Security Division 2012 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance):

INTRODUCTION.....................................................................................................................1 | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------| | 1.1 | | PURPOSE ............................................................................................................................1 | | | 1.2 | | SCOPE ................................................................................................................................1 | | | 1.3 | | TARGET AUDIENCE | ............................................................................................................2 | | | 1.4 | DOCUMENT OVERVIEW......................................................................................................3 | | | 2.

PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Guide for Security-Focused Configuration Management of Information Systems:

3.3.1 IMPLEMENT ACCESS RESTRICTIONS FOR CHANGE

Access restrictions for change represent the enforcement side of SecCM. 3.3.1  Handling of Scheduled, Unscheduled, and Unauthorized Changes
- 3.

Guide for Security-Focused Configuration Management of Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Technical Guide to Information Security Testing and Assessment:

| 4.4 | Wireless Scanning | ...................................................................................................4-6 | | | 4.4.1 Passive Wireless Scanning ..........................................................................4-8 | | | | 4.4.2 Active Wireless Scanning.............................................................................4-9 | | | | 4.4.3 Wireless Device Location Tracking | ..............................................................4-9 | | | 4.4.4 Bluetooth Scanning ....................................................................................4-10 | | | 4.5 | Summary................................................................................................................4-10 | | | Target Vulnerability Validation Techniques | ..................................................................5-1 | | | 5.1 | Password Cracking..................................................................................................5-1 | | | 5.2 | Penetration Testing..................................................................................................5-2 | | | | 5.2.1 Penetration Testing Phases | .........................................................................5-2 | | | 5.2.2 Penetration Testing Logistics | .......................................................................5-5 | | 5.3 | Social Engineering...................................................................................................5-6 | | | 5.4 | Summary..................................................................................................................5-7 | | | Security Assessment | Planning.......................................................................................6-1 | | | 6.1 | Developing a Security Assessment Policy...............................................................6-1 | | | 6.2 | Prioritizing and Scheduling Assessments................................................................6-1 | | | 6.3 | Selecting and Customizing Techniques...................................................................6-3 | |

Technical Guide to Information Security Testing and Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Guide to Computer Security Log Management:

applications such as supply chain management, financial management, procurement systems, enterprise resource planning, and customer relationship management.  In addition to COTS and GOTS software, most organizations also use custom-developed applications tailored to their specific requirements. 8

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Zero Trust Architecture provide? (Part 2)

[Assistant]
as normas y directrices no se aplicarán a los sistemas de seguridad nacional sin la aprobación expresa de los funcionarios federales apropiados que ejercen la autoridad política sobre dichos sistemas.
Esta directriz es coherente con los requisitos de la Circular A-130 de la Oficina de Gestión y Presupuesto (OMB). Nada  de  lo  que  figura  en  esta  publicación  debe  interpretarse  como  contradictorio  con  las  normas  y directrices que el Secretario de Comercio ha hecho obligatorias y vinculantes para los organismos federales en  virtud  de  la  autoridad  legal. Estas  directrices  tampoco  deben  interpretarse  como  una  alteración  o sustitución de las autoridades existentes del Secretario de Comercio, el Director de la OMB o cualquier otro funcionario federal. Esta publicación puede ser utilizada por organizaciones no gubernamentales de forma  voluntaria  y  no  está  sujeta  a  derechos  de  autor  en  los  Estados  Unidos. No  obstante,  el  NIST agradecerá que se cite su procedencia. Publicación especial 800-207 del Instituto Nacional de Estándares y Tecnología (NIST)

Inst. Nac. Est. Technol. Publ. Espec. 800-207, 59 páginas (agosto de 2020) CODEN: NSPUE2

Esta publicación está disponible en inglés de forma gratuita en: https://doi.org/10.6028/NIST.SP.800-207

En este documento pueden identificarse ciertas entidades, equipos o materiales comerciales con el fin de describir adecuadamente un procedimiento o concepto experimental. Dicha identificación no implica una recomendación o aprobación por parte del NIST, ni que las entidades, materiales o equipos sean necesariamente los mejores disponibles para el propósito. En esta publicación puede haber referencias a otras que actualmente están siendo desarrolladas por NIST de acuerdo con sus responsabilidades estatutarias asignadas.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities:

\_i.ligaga/t\_i.ligaon; labeled dataset; genera/t\_i.ligaon tool; graph genera/t\_i.ligaon; AI models; formal methods; CVE; CWE; NVD; KEV. | 2. | Current State of the Art . | . . . . . . . . . . . . .
|   3 |
|------|-----------------------------------------|-----------------------------------------------------------------------------|-----|
| 3. | Bugs Framework Formalism . . . . . | . . . . . . . . . . . . |   5 |
|      | 3.1. | BF Opera/t_i.ligaon . . . . . . . . . . . . |   7 |
|      | 3.2. | BF Bug, Fault, and Weakness . . . . . . . . . . . . . . . . |   8 |
|      | 3.3. | BF Vulnerability . . . . . . . . |  10 |
|      | 3.4. | BF Bug Iden/t_i.liga/uniFB01ca/t_i.ligaon . . . . . . . . . . . . . . . . |  13 |
| 4. | BF Security Concepts . . | . . . . . . . . . . . . . |  14 |
| 5. | BF Bugs Models . | . . . . . . . . . . . . . . . . |  16 |
|      | 5.1. | BF Input/Output Check ( INP) Bugs Model . . . . . . |  16 |
|      | 5.2. | BF Memory ( MEM) Bugs Model                                                 |  17 |
|      | 5.3. | BF Data Type ( DAT) Bugs Model . . . . . . . . . |  18 |
| 6. | BF Taxonomy . . . . . . . . . . . . . . | . . . . . . . |  20 |
|      | 6.1. | BF Weakness Classes . . . . . . . . . . . . . |  20 |
|      | 6.2. | BF Failure Class . . . . . . . . . . . . . |  26 |
|      | 6.3. | BF Methodology . . . . . . . . . . . . . . . |  26 |
| 7. | BF Vulnerability Models                 | . . . . . . . . . . . . . . |  29 |
|      | 7.1. | BF Vulnerability State Model . . . . . . . . |  29 |
|      | 7.2. | BF Vulnerability Speci/uniFB01ca/t_i.ligaon Model . . . . . . . . . . . . . |  35 |
| 8. | BF Formal Language . . . . . . | . . . . . . |  39 |
|      | 8.1. | BF Lexis . . . . . . . . . . . . . . . |  40 |
|      | 8.2. | BF Syntax . . . . . . . . . . . . . . . . . . . |  42 |
|      | 8.3. | BF Seman/t_i.ligacs . . . . . . . . . . . . . . . . . |  44 |
| 9. | BF Secure Coding Principles             | . . . . . . . . . . . .

Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Secure Domain Name System (DNS) Deployment Guide:

Checklist Item 27: If the zone is signed using NSEC3 RRs, the iterations value should be based on available computing power available to clients and attackers.  The value should be reviewed annually and increased if the evaluation conditions change.  Initial values should be between 1 and 200 iterations when using SHA-1 and 1 and 100 if using SHA-256.

- Checklist item 26: If the zone is signed using NSEC3 RRs, the salt value should be changed every time the zone is completely resigned.  The value of the salt should be random, and the length should be short enough to prevent a FQDN to be too long for the DNS protocol (i.e. under 256 octets).
- Checklist item 27: If the zone is signed using NSEC3 RRs, the iterations value should be based on available computing power available to clients and attackers.  The value should be reviewed annually and increased if the evaluation conditions change.
- Checklist item 28: TTL values for DNS data should be set between 30 minutes (1800 seconds) and 24 hours (86400 seconds).
- Checklist item 29 : TTL values for RRsets should be set to be a fraction of the DNSSEC signature validity period of the RRSIG that covers the RRset.

Secure Domain Name System (DNS) Deployment Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

- Authority and Purpose (AP);
- Accountability, Audit, and Risk Management (AR);
- Data Quality and Integrity (DI);
- Data Minimization and Retention (DM);
- Individual Participation and Redress (IP);
- Security (SE);
- Transparency (TR); and,
- Use Limitation (UL).

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Engineering Trustworthy Secure Systems:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. | F.2. | Assurance..............................................................................................................104                                                                                | Assurance..............................................................................................................104   |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|
| Appendix G. | Appendix G. | Life Cycle Processes Overview..............................................110                                               |
| G.1. Process Overview..................................................................................................110                                                                                | G.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are concerned about the risks associated with products and services that may potentially contain malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the supply chain. These risks are associated with an enterprise's decreased visibility into and understanding of how the technology they acquire is developed, integrated, and deployed or the processes, procedures, standards, and practices used to ensure the security, resilience, reliability, safety, integrity, and quality of the products and services.

This publication provides guidance to organizations on identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels of their organizations. The publication integrates cybersecurity supply chain risk management (C-SCRM) into risk management activities by applying a multilevel, C-SCRM-specific approach, including guidance on the development of C-SCRM strategy implementation plans, C-SCRM policies, C-SCRM plans, and risk assessments for products and services.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Digital Identity Guidelines_ Authentication and Authenticator Management provide?

[Assistant]
NIST Special Publication
NIST SP 800-63B-4

Digital Identity Guidelines
Authentication and Authenticator Management

David Temoshok
James L. Fenton
Yee-Yin Choong
Naomi Lefkovitz
Andrew Regenscheid
Ryan Galluzzo
Justin P. Richer

This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-63B-4

NIST Special Publication
NIST SP 800-63B-4

Digital Identity Guidelines
Authentication and Authenticator Management

David Temoshok
Naomi Lefkovitz *
Ryan Galluzzo
Applied Cybersecurity Division
Information Technology Laboratory

Yee-Yin Choong
Information Access Division
Information Technology Laboratory

Andrew Regenscheid
Computer Security Division
Information Technology Laboratory

James L. Fenton
Altmode Networks

Justin P. Richer
Bespoke Engineering

* Former NIST employee; all work for this publication was done while at NIST. This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-63B-4

July 2025

National Institute of Standards and Technology
Craig Burkhardt, Acting Under Secretary for Standards and Technology and Acting NIST Director

U.S. Department of Commerce
Howard Lutnick, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial,
are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product
or service by NIST, nor does it imply that the materials or equipment identified are
necessarily the best available for the purpose. There may be references in this publication to other publications currently under
development by NIST in accordance with its assigned statutory responsibilities. The
information in this publication, including concepts and methodologies, may be used by
federal agencies even before the completion of such companion publications.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Recommendation for Block Cipher Modes of Operation_ Methods for Key Wrapping provide?

[Assistant]
NIST Special Publication 800-38F December 2012

<!-- image -->

## Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping

Morris Dworkin

## C  O  M  P  U  T  E  R     S  E  C  U  R  I  T  Y

NIST Special Publication 800-38F

## Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping

Morris Dworkin

## C  O  M  P  U  T  E  R     S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899

December 2012

<!-- image -->

## U.S. Department of Commerce

Rebecca M. Blank, Acting Secretary

National Institute of Standards and Technology Patrick D. Gallagher, Director

## NIST Special Publication 800-38F

## Reports on Information Security Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to  advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts  in  computer  security,  and  its  collaborative  activities  with  industry,  government,  and academic organizations. Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.

Recommendation for Block Cipher Modes of Operation_ Methods for Key Wrapping


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Configuration Management?

[Assistant]
According to Fiscal Year 2024 Cybersecurity and Privacy Annual Report:

ed the IoT Interagency Federal Working Group and collaborated with the IoT Advisory Board as it developed findings and recommendations on how the U.S. can reduce barriers to adopting IoT technologies.
The findings were documented in a September 2024 report.

Fiscal Year 2024 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. - Illustrative diagram, schematic, or photograph of the module. A photograph included for hardware modules. If the security policy encompasses multiple versions of the module, each version is represented separately or annotated that the representation is illustrated for all versions. For a software or , firmware, hybrid, or sub-chip cryptographic module, the security policy includes a block diagram that illustrates:
- o The location of the logical object of the software or firmware module with respect to the operating system, other supporting applications, and the cryptographic boundary so that all of the logical and physical layers between the logical object and the cryptographic boundary are clearly defined and
- o The interactions of the logical object of the software or firmware module with the operating system and other supporting applications resident within the cryptographic boundary.

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Managing the Security of Information Exchanges:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Information exchange occurs via communications technology usually provided by an internet service provider (ISP) or via a system interconnection (physical or virtual), which may itself employ the services of an ISP or telecommunications vendor. Methods to exchange information and for which some type of information exchange agreement 4  may be warranted include but are not limited to direct exchange (including access) across a system interconnection, electronic or digital file transfers, file-sharing services, database access/sharing or exchanges of database transaction information, exchange of information via portable storage device (which does not use an ISP or system interconnection), and email exchange.

The dedicated or on-demand circuit or the VPN is the 'pipe' that connects the systems. Employment of a dedicated circuit may be more expensive, but it provides greater security assurance for the information exchange because the circuit may only be breached through a direct physical intrusion.

Managing the Security of Information Exchanges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation:

3.3.1.

Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

Semiconductor-based hardware is the foundation of modern-day electronics - from smartphones, computers, and telecommunications to transportation and critical infrastructure. The semiconductor hardware supply chain is a complex network of companies that collectively provide intellectual property, designs, and raw materials and manufacture, test, package, and distribute products. Coordination among the components of a supply chain is required at different stages, including inception, deployment to end users, maintenance during use, and disposal or end of life. Securing semiconductor-based hardware and their supply chains help protect sensitive information, maintain the integrity of systems, and ensure overall stability across the infrastructure and connected world.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Managing the Security of Information Exchanges:

Managing the Security of Information Exchanges provides guidance for planning, establishing, maintaining, and discontinuing information exchange and access between systems that are owned and operated by different organizations (internal or external) or that cross authorization boundaries. The guidance is consistent with the requirements specified in the Office of Management and Budget (OMB) Circular A-130 for the secure management of information exchanges. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. |
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| 1                                                                                | Introduction.....................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface:

3.2.4.

Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guidelines on Electronic Mail Security:

- GLYPH<c=31,font=/HABHKN+Webdings> Types of personnel required (e.g., system and mail server administrators, network administrators, information systems security officers)
- GLYPH<c=31,font=/HABHKN+Webdings> Skills and training required by assigned personnel
- GLYPH<c=31,font=/HABHKN+Webdings> Availability of personnel.

- GLYPH<c=31,font=/HABHKN+Webdings> Coordinating the development and maintenance of the organization's information security policies, standards, and procedures
- GLYPH<c=31,font=/HABHKN+Webdings> Coordinating the development and maintenance of the organization's change control and management procedures
- GLYPH<c=31,font=/HABHKN+Webdings> Ensuring the establishment of, and compliance with, consistent IT security policies for departments throughout the organization
- GLYPH<c=31,font=/HABHKN+Webdings> Coordinating with upper management, public affairs, and other relevant personnel to produce a formal policy and process for email usage guidelines (e.g., personal use, monitoring, encryption).

The greatest challenge and expense in developing and securely maintaining a mail server is providing the necessary human resources to adequately perform the required functions.  Many organizations fail to fully realize the amount of expense and skills required to field a secure mail server.  This failure often results in overworked employees and insecure systems.   From the initial planning stages, organizations need to determine the necessary human resource requirements.  Appropriate and sufficient human resources are the single most important aspect of mail server security.  Organizations should also consider the fact that, in general, technical solutions are not a substitute for skilled and experienced personnel.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to System and Network Security Acronyms and Abbreviations:

ds of electromagnetic radiation to personnel   |
| HF       | high frequency                                      |
| HFS      | Hierarchical File System                            |
| HHS      | U.S.
Department of Health and Human Services        |
| HINFO    | host information                                    |
| HIP      | Host Identity Protocol                              |
| HIPAA    | Health Insurance Portability and Accountability Act |
| HIPERLAN | high-performance radio local area network           |
| HKLM     | HKEY_Local_Machine                                  |
| HL7      | Health Level Seven                                  |
| HMAC     | keyed-hash message authentication code              |
| HMI      | human-machine interface                             |
| HPA      | host protected area                                 |
| HPFS     | High-Performance File System                        |
| HR       | human resources                                     |
| HSARPA   | Homeland Security Advanced Research Projects Agency |
| HSPD     | Homeland Security Presidential Directive            |
| HTCIA    | High Technology Crime Investigation Association     |
| HTCP     | Hyper Text Caching Protocol                         |
| HTML     | Hypertext Markup Language                           |
| HTTP     | Hypertext Transfer Protocol                         |
| HTTPS    | Secure Hypertext Transfer Protocol                  |
| Hz       | hertz                                               |

System and Network Security Acronyms and Abbreviations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3:

- Content authors and editors seeking to ensure that the SCAP source content they produce operates correctly, consistently, and reliably in SCAP products.
- Software developers and system integrators seeking to create, use, or exchange SCAP content in their products or service offerings.
- Product developers preparing for SCAP validation at an accredited independent testing laboratory.

1. For each <xccdf:check-content-ref> element, a content consumer either SHALL attempt to retrieve the document referenced by the <ds:component-ref> element that is referenced directly by the <xccdf:check-content-ref> element's @href attribute, or it SHALL resolve the @href attribute within the context of the XML Catalog specified as part of the <ds:component-ref> element used to reference this benchmark. If not resolvable, the next available <xccdf:check-content-ref> element SHALL be evaluated. If none of the <xccdf:check-content-ref> elements are resolvable, then the result of the rule evaluation SHALL be the XCCDF 'notchecked' status and processing of the check SHALL end.
2. Once a resolvable <xccdf:check-content-ref> element is found, then checking system processing SHALL proceed. When evaluating a rule, an < xccdf:ruleresult/xccdf:message > with the @severity attribute value of 'info' SHALL be generated, indicating the < xccdf:check-content-ref > @href attribute and @name attribute, if provided.

An SCAP result data stream contains the results of the evaluation of one or more SCAP source data streams by an SCAP content consumer. The following requirements and recommendations pertain to content consumers generating SCAP result data streams.

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program:

Organizational, financial, and regulatory reasons drive the desire to build a robust information security measurement program. Such programs facilitate decision-making and improve performance and accountability by providing a structure for collecting, analyzing, and reporting relevant and related data. Organizations can use measures as management tools in their internal improvement efforts and link the implementation of their information security programs to agency- and enterprise-level planning efforts. An information security measurement program can increase accountability by helping organizations identify if specific controls that are implemented correctly, are not implemented, or are ineffective. The continuous feedback provided by a structured measurement program supports regular internal communications that collect data about information security performance and risks for high-level members of the organization. Implementing an information security measurement program demonstrates an organizational commitment to proactive information security and continuous improvement. For example, organizations that use the Cybersecurity Capacity Maturity Model (CMM) may implement a measurement program as part of the goal of demonstrating the Level 4, 'Managed,' degree of performance. When using the appropriate measures, an information security measurement program enables organizations to quantify improvements in securing systems and demonstrate quantifiable progress in accomplishing strategic goals and objectives. More information on selecting measures can be found in SP 800-55v1. This section outlines the key roles and responsibilities for developing and implementing an information security measurement program. While all organization members are ultimately responsible for information security, the positions described here are specific to key information security stakeholders.

Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to U.S. Department of Energy Risk Assessment Methodology:

ents (BLSRs) set forth in all applicable DOE Orders. The Baseline Security Requirements as used in this guideline encompass DOE Orders 1360. 2A, 5637.1, and all relevant guidelines, orders, laws, etc.
In the previous step you identified whether your system was involved in sensitive unclassified or classified processing. In this step, you are asked to review brief lists of security countermeasures (baseline security requirements) that MUST be in place, per the applicable DOE orders

U.S. Department of Energy Risk Assessment Methodology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3:

- Languages. The SCAP languages provide standard vocabularies and conventions for expressing security policy, technical check mechanisms, and assessment results. The SCAP language specifications are Extensible Configuration Checklist Description Format (XCCDF), Open Vulnerability and Assessment Language (OVAL), and Open Checklist Interactive Language (OCIL). - Reporting formats. The SCAP reporting formats provide the necessary constructs to express collected information in standardized formats. The SCAP reporting format specifications are Asset Reporting Format (ARF) and Asset Identification. Although Asset Identification is not explicitly a reporting format, SCAP uses it as a key component in identifying the assets that reports relate to. - Identification schemes. The SCAP identification schemes provide a means to identify key concepts such as software products, vulnerabilities, and configuration items using standardized identifier formats. They also provide a means to associate individual identifiers with additional data pertaining to the subject of the identifier. The SCAP identification scheme specifications are Common Platform Enumeration (CPE), Software Identification (SWID) Tags, Common Configuration Enumeration (CCE), and Common Vulnerabilities and Exposures (CVE). - Measurement and scoring systems. In SCAP this refers to evaluating specific characteristics of a security weakness (for example, software vulnerabilities and security configuration issues) and, based on those characteristics, generating a score that reflects their relative severity. The SCAP measurement and scoring system specifications are Common Vulnerability Scoring System (CVSS) and Common Configuration Scoring System (CCSS). - Integrity. An SCAP integrity specification helps to preserve the integrity of SCAP content and results. Trust Model for Security Automation Data (TMSAD) is the SCAP integrity specification.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

This publication provides guidance to organizations on identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels of their organizations. The publication integrates cybersecurity supply chain risk management (C-SCRM) into risk management activities by applying a multilevel, C-SCRM-specific approach, including guidance on the development of C-SCRM strategy implementation plans, C-SCRM policies, C-SCRM plans, and risk assessments for products and services. acquire; C-SCRM; cybersecurity supply chain; cybersecurity supply chain risk management; information and communication technology; risk management; supplier; supply chain; supply chain risk assessment; supply chain assurance; supply chain risk; supply chain security. | 3.4.3. Enhancing Practices....................................................................................................................49      |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.5.1. Measuring C-SCRM Through Performance Measures................................................................52                                |                                                                                |
| References.........................................................................................................................................57 |                                                                                |
| Appendix A. C-SCRM Security Controls...............................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide provide? (Part 5)

[Assistant]
and 'need not' indicate a course of action permissible within the limits of the publication. The terms 'can' and 'cannot' indicate a possibility and capability, whether material, physical, or causal.
## Disclaimer

This publication offers general guidance and is provided for informational purposes. This publication should not be construed or relied upon as legal advice or guidance. This document does not modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, or any other federal law or regulation. The participation of other federal organizations with the National Institute of Standards and Technology (NIST) in the development of this Special Publication does not and shall not be deemed to constitute the endorsement, recommendation, or approval by those organizations of its contents. The use of this publication or any other NIST publication does not ensure or guarantee that an organization will be compliant with the Security Rule. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Computer Security Division 2007 Annual Report:

53 | | Computer Security Division Publications - FY 2007 | 54 | | Ways to Engage Our Division and NIST | 56 |

Computer Security Division 2007 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automated Information System Security Accreditation Guidelines provide? (Part 4)

[Assistant]
| 8. | SUMMARY                                                 | 33               |
| 9. ACCREDITATION TRANSMITTAL             | 9. ACCREDITATION TRANSMITTAL             | 9.
ACCREDITATION TRANSMITTAL                            | 3 5              |
| ACCREDITATION ACTION                     | ACCREDITATION ACTION                     | ACCREDITATION ACTION                                    |                  |
| APPENDIX                                 | APPENDIX                                 | APPENDIX                                                | i                |
| AISSM                                    | AISSM                                    | AISSM                                                   | i                |
|                                          | AISSC                                    | AISSC                                                   | i                |
| THE DAA ii FORMS                         | THE DAA ii FORMS                         | THE DAA ii FORMS                                        | THE DAA ii FORMS |
| 1. DPA Security Profile                  | 1. DPA Security Profile                  | 1. DPA Security Profile                                 | 13               |
| 2. Office Automation DPA Risk Assessment | 2. Office Automation DPA Risk Assessment | 2. Office Automation DPA Risk Assessment                | 19               |
| 3. Contingency Plan Waiver               | 3. Contingency Plan Waiver               | 3. Contingency Plan Waiver                              | 31               |
| 4. Sensitive Application Security        | 4. Sensitive Application Security        | Certification Waiver                                    | 34               |
| 5. Accreditation Request                 | 5. Accreditation Request                 | 5. Accreditation Request                                | 37               |
| 6. Accreditation Statement               | 6.

Automated Information System Security Accreditation Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS):

access control; confidentiality; cryptographic key management system; disaster recovery; federal cryptographic key management system; integrity; metadata; security assessment; security functions; security policies; source authentication. |         | 6.7.2 Restricting Cryptographic Module Entry and Output of Plaintext                                                   | Keys............................................................................................65         |
|---------|------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------|
|         | 6.7.3 Controlling Human Input.....................................................................65                   |                                                                                |
|         | 6.7.4 Multiparty Control                                                                                | ...............................................................................66                          |
|         | 6.7.5 Key Splitting                                                                                | .......................................................................................66                  |
| 6.8     | Compromise Recovery .................................................................................

A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to A Review of U.S. and European Security Evaluation Criteria:

* Division D; Minimal Protection -This division contains only one class. It is reserved for those systems that have been evaluated but that fail to meet the requirements for a higher evaluation class.
* Division C: Discretionary Protection -Classes in this division provide discretionary (need-to-know) protection and, through the inclusion of audit capabilities, accountability of subjects and the actions they initiate.
* Division B; Mandatory Protection -The concept of a security relevant or Trusted Computing Base (TCB) that preserves the integrity of sensitivity labels and uses them to enforce a set of mandatory access control rules

Part II describes a number of additional security services (e.g., communications integrity, denial of service, transmissions security) that arise in conjunction with networks. The full range of physical and administrative security measures appropriate to the highest sensitivity level of information on the network must be in place in order to operate a trusted network as described in the Red Book

The term integrity as used in the Red Book requires some explanation. In Part I integrity refers to the correct operation of the network trusted computer base hardware/ firmware , and protection against unauthorized modification of labels and data. Division A and B networks must protect the labels that represent the sensitivity of information and the corresponding authorizations of users.

A Review of U.S. and European Security Evaluation Criteria


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Computer Security Division 2013 Annual Report:

inistration (GSA), Bureau of the Fiscal Service, and NIST. Recent administration guidance directing  federal  agencies  to  reduce  travel  and  conference budgets  significantly  reduced  attendance.
Technical  sessions included  briefings on  evolving  cybersecurity  strategies, IT security concerns during a consolidation (merger), supply chain risk management activities, the National Vulnerability Database (NVD), SP 800-53 Revision 4, continuous monitoring, industrial control systems security, and EO 13636.

Computer Security Division 2013 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to The NIST Cybersecurity Framework (CSF) 2.0:

Individuals responsible for developing and leading cybersecurity programs are the primary audience for the CSF. The CSF can also be used by others involved in managing risk - including executives, boards of directors, acquisition professionals, technology professionals, risk managers, lawyers, human resources specialists, and cybersecurity and risk management auditors - to guide their cybersecurity-related decisions. Additionally, the CSF can be useful to those making and influencing policy (e.g., associations, professional organizations, regulators) who set and communicate priorities for cybersecurity risk management. The CSF is the result of a multi-year collaborative effort across industry, academia, and government in the United States and around the world. NIST acknowledges and thanks all of those who have contributed to this revised CSF. Information on the CSF development process can be found on the NIST CSF website. Lessons learned about the use of the CSF can always be shared with NIST at cyberframework@nist.gov. - on C-SCRM. SP 800-161r1 (Revision 1), Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations , provides in-depth information on C-SCRM. - Risks from emerging technologies: As new technologies and new applications of technology become available, new risks become clear. A contemporary example is artificial intelligence (AI), which has cybersecurity and privacy risks, as well as many other types of risk. The NIST Artificial Intelligence Risk Management Framework (AI RMF) was developed to help address these risks. Treating AI risks alongside other enterprise risks (e.g., financial, cybersecurity, reputational, and privacy) will yield a more integrated outcome and organizational efficiencies. Cybersecurity and privacy risk management considerations and approaches are applicable to the design, development, deployment, evaluation, and use of AI systems.

The NIST Cybersecurity Framework (CSF) 2.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies may be used by federal agencies even before the completion  of  such  companion  publications. Thus,  until  each  publication  is  completed,  current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ...................................................................................................

Control Baselines for Information Systems and Organizations